CompTIA Network+ — All Questions

Which VPN type permanently connects two office networks over the internet so hosts communicate as if on one network, without client software on each device?

• a.Site-to-site VPN✓
• b.Host-to-host VPN
• c.Full-tunnel client VPN
• d.Clientless SSL VPN

A site-to-site VPN links two networks through gateways, encrypting traffic between locations so hosts communicate transparently without individual client software. It is typically always on between offices. Remote-access VPNs, by contrast, connect individual users.

A remote user's VPN sends only corporate-bound traffic through the tunnel while internet browsing goes directly out. Which configuration is this?

• a.Full tunnel
• b.Clientless VPN
• c.Split tunnel✓
• d.Site-to-site tunnel

Split tunneling routes only traffic destined for the corporate network through the VPN while other traffic goes directly to the internet. It saves bandwidth but reduces visibility and control over general browsing. Full tunnel sends all traffic through the VPN for tighter security.

Which remote-access method lets a user reach internal web applications through an HTTPS portal without installing a dedicated VPN client?

• a.Clientless SSL/TLS VPN✓
• b.GRE tunnel
• c.IPsec site-to-site VPN
• d.L2TP tunnel

A clientless SSL/TLS VPN provides access to internal web applications through a standard browser over HTTPS, with no dedicated client software. It is convenient for occasional access from untrusted devices. Full VPN clients are still preferred for broad, native network access.

Administrators connect to a single hardened, monitored host and from there manage sensitive servers. What is this host called?

• a.A honeypot
• b.A proxy cache
• c.A load balancer
• d.A jump box (bastion host)✓

A jump box, or bastion host, is a hardened, closely monitored system through which administrators access sensitive segments. Funneling admin access through it centralizes logging and control. It reduces direct exposure of critical systems to the broader network.

A login that requires a password plus a one-time code from an authenticator app satisfies which security concept?

• a.Single sign-on
• b.Multifactor authentication✓
• c.Federation
• d.Role-based access control (RBAC)

Multifactor authentication combines factors from different categories, here something you know (the password) and something you have (the authenticator app). This makes a stolen password alone insufficient. Requiring distinct factor types is what makes it multifactor.

Which AAA protocol separates authentication, authorization, and accounting and encrypts the entire packet body, making it popular for device administration?

• a.TACACS+✓
• b.Kerberos
• c.LDAP
• d.RADIUS

TACACS+ separates the three AAA functions and encrypts the full payload, giving granular command authorization prized for network device administration. RADIUS combines authentication and authorization and encrypts only the password. TACACS+ also runs over TCP for reliability.

Which AAA protocol is commonly paired with 802.1X to authenticate wired and wireless clients and encrypts only the password field?

• a.TACACS+
• b.SNMPv3
• c.RADIUS✓
• d.SAML

RADIUS is widely used with 802.1X to authenticate network clients and encrypts only the password within its packets. It combines authentication and authorization and runs over UDP. It is the standard back end for enterprise Wi-Fi and NAC.

Which 802.1X authentication method requires a digital certificate on both the client and the server, avoiding passwords entirely?

• a.Open authentication
• b.PSK
• c.EAP-TLS✓
• d.PAP

EAP-TLS uses mutual certificate authentication, requiring valid certificates on both client and server, so no password is transmitted. This makes it one of the strongest 802.1X methods. It requires a PKI to issue and manage the certificates.

Which capability lets a user authenticate once and then access multiple applications without logging in again?

• a.Least privilege
• b.Multifactor authentication
• c.Single sign-on (SSO)✓
• d.Separation of duties

Single sign-on lets a user authenticate once and gain access to many applications without repeated logins, improving convenience and reducing password fatigue. It is often paired with MFA for strong assurance. Federation extends SSO across organizational boundaries.

Requiring two different administrators to each perform part of a sensitive task so no one person controls it end to end describes which principle?

• a.Least privilege
• b.Separation of duties✓
• c.Zero trust
• d.Defense in depth

Separation of duties splits a sensitive task among multiple people so no single individual can complete it alone, reducing fraud and error. Least privilege limits each person's access, a related but distinct idea. Together they strengthen internal control.

A monitoring team must poll router statistics across a segment where credentials could be captured, so they need both authentication and encryption for the management traffic. Which SNMP version should they deploy?

• a.SNMPv2c
• b.SNMPv3✓
• c.SNMPv1
• d.the community-string model used by the earlier SNMP versions

SNMPv3 adds authentication and encryption (authPriv), unlike v1 and v2c which rely on clear-text community strings. It is the only version that protects management data in transit. Choose v3 whenever confidentiality or integrity of monitoring matters.

Within SNMP, which component is the hierarchical database that defines the managed objects a device exposes, each identified by a numeric object identifier?

• a.The MIB✓
• b.An unsolicited SNMP trap
• c.The read-only community string configured on the agent
• d.A single OID value

The MIB (Management Information Base) is the structured catalog of managed objects, each addressed by an OID. Agents return MIB values when the manager polls them. Understanding the MIB/OID relationship is key to building useful monitoring.

On a syslog server, an engineer wants to alert only on the most critical device messages. Which numeric severity level represents the highest urgency?

• a.0 (emergency)✓
• b.5 (notice)
• c.the highest number in the range, because a larger value signals more urgency
• d.7 (debugging)

Syslog severities run 0 to 7, where 0 (emergency) is the most severe and 7 (debugging) the least. Lower numbers mean higher urgency, which is counterintuitive at first. Filtering on 0-2 captures messages that usually demand immediate attention.

A capacity-planning report needs a summary of which hosts and applications consume the most bandwidth, grouped by conversation rather than by full packet contents. Which data source best provides this?

• a.Flow data such as NetFlow✓
• b.Basic SNMP interface polling
• c.A packet sniffer capturing every full frame on the link
• d.Syslog messages from the router

Flow technologies like NetFlow, sFlow, and IPFIX summarize traffic into conversation records (source, destination, ports, bytes). This gives top-talker and application visibility without storing full packets. It is lighter than a capture yet richer than raw interface counters.

A team finds some SNMP notifications are lost in transit and wants the manager to acknowledge receipt so the agent can retransmit if needed. Which notification type provides this confirmation?

• a.An SNMP GET request
• b.An SNMP trap
• c.A one-way syslog message delivered over UDP without acknowledgment
• d.An SNMP inform✓

An SNMP inform is an acknowledged notification; the manager confirms receipt so the agent can resend if the message is lost. A trap is fire-and-forget with no acknowledgment. Informs trade extra overhead for reliability.

Security operations wants logs from firewalls, servers, and switches gathered in one place, normalized, and correlated to surface multi-device attack patterns. Which platform is designed for this?

• a.A SIEM✓
• b.A DHCP server
• c.An NTP time source
• d.A TFTP server used for config backups

A SIEM (Security Information and Event Management) aggregates and correlates logs from many sources to detect patterns a single device would miss. It adds alerting, retention, and search on top of raw syslog. Synchronized time via NTP makes its correlation trustworthy.

To decide when interface utilization is abnormal, an operations team compares live metrics against previously recorded normal values. What are they comparing against?

• a.The current routing table
• b.The maximum rated link speed
• c.The switch's original factory-default configuration settings
• d.A performance baseline✓

A performance baseline records normal utilization, latency, and error rates so deviations can trigger alerts. Thresholds are usually set relative to the baseline rather than to a device's rated maximum. Baselines must be refreshed as the network grows.

Which per-port data does a monitoring system read to calculate link utilization, error rates, and discards on a switch?

• a.The ARP cache
• b.The spanning-tree topology table maintained by the switch
• c.Interface counters✓
• d.DNS query logs

Interface counters track bytes, packets, errors, and discards per port, and tools poll them (often via SNMP) to compute utilization. Rising error or discard counters flag physical or congestion problems. They are the foundation of throughput dashboards.

A data-center team wants automated alerts if a wiring closet gets too hot or humid before equipment is damaged. Which monitoring input provides this?

• a.A NetFlow exporter
• b.A syslog facility code
• c.Environmental sensors✓
• d.An SNMP trap threshold set on router CPU load

Environmental sensors report temperature, humidity, water, and airflow, feeding alerts that prevent heat- or moisture-related failures. They are often integrated into the same NMS that tracks network metrics. Early warning here avoids costly hardware damage.

A modern platform needs sub-second, push-based metrics from devices instead of waiting for the next polling interval. Which approach delivers this?

• a.Manual CLI checks by an on-call engineer
• b.SNMP polling on a fixed five-minute interval
• c.Periodic ICMP pings
• d.Streaming telemetry✓

Streaming telemetry has devices continuously push metrics to a collector, giving near-real-time granularity that periodic SNMP polling cannot match. It scales better for large, fast-changing environments. Polling still suits simpler or legacy gear.

An operations lead wants to monitor network devices without installing extra software on each one, relying on protocols already built into the gear. Which monitoring model fits?

• a.Agentless polling✓
• b.Mirroring all ports to a dedicated packet sniffer
• c.Installing a proprietary monitoring agent on every managed device
• d.Exporting device logs by hand each week

Agentless monitoring uses protocols already on the device, such as SNMP, ICMP, or SSH, avoiding software installs. It is quick to deploy across mixed hardware. Agent-based monitoring can offer deeper data but adds installation and upkeep.

To diagnose a subtle application handshake failure, an analyst needs the actual bytes of each packet, not just summary statistics. Which tool output is required?

• a.A NetFlow conversation record
• b.An interface utilization graph
• c.A full packet capture✓
• d.An SNMP walk of the device MIB

A full packet capture (via Wireshark, tcpdump, or a SPAN port) records complete frame contents for deep protocol analysis. Flow and SNMP data only summarize traffic and cannot show payload detail. Captures are powerful but storage-intensive, so they are used selectively.

Auditors ask how long the organization keeps device and security logs before they are purged. Which document defines this?

• a.A log retention policy✓
• b.A memorandum of understanding between two parties
• c.An acceptable use policy
• d.The spanning-tree configuration

A log retention policy specifies how long logs are stored and when they are deleted, balancing investigative and compliance needs against storage cost. It often reflects regulatory requirements. Consistent retention ensures evidence exists when incidents surface late.

In SNMPv2c, which credential lets a manager poll device values but not change the configuration?

• a.A trap receiver address
• b.A read-write credential that also permits pushing configuration changes
• c.An OID
• d.A read-only community string✓

A read-only community string permits GET operations but denies SET, so monitoring cannot alter the device. Because v2c community strings are clear-text, SNMPv3 is preferred where security matters. Read-write strings are far more sensitive and should be tightly controlled.

Management wants an at-a-glance visual view of uptime, utilization, and open alert counts across key links. Which operations artifact provides this?

• a.A one-time ARP table export
• b.A single syslog severity filter
• c.A paper change-request form
• d.A monitoring dashboard✓

A monitoring dashboard visualizes KPIs like uptime, utilization, latency, and open alerts for quick situational awareness. It aggregates data from SNMP, flow, and log sources. Well-designed dashboards speed detection and reporting.

A technician needs to know exactly which patch-panel port and cable run connect a specific wall jack to the switch. Which document shows this?

• a.A logical diagram showing subnets and VLANs
• b.A rack power-load schedule
• c.A physical network diagram✓
• d.An IP address allocation plan

A physical network diagram maps actual cabling, ports, panels, and device locations. A logical diagram instead shows IP subnets, VLANs, and routing relationships. The two are maintained together because each answers different questions.

As subnets multiply, a team wants a single authoritative record of which IP addresses are assigned, reserved, or free. Which tool manages this?

• a.A change advisory board that reviews proposed changes
• b.An IPAM system✓
• c.A syslog server
• d.A rack elevation diagram

IPAM (IP Address Management) tracks address allocation, reservations, and availability, often integrating DNS and DHCP. It prevents conflicts and address exhaustion. Spreadsheets do not scale to large or dynamic networks.

Before installing a new 2U server, an engineer checks a drawing that shows which rack units are occupied and where free space and power exist. What is this document?

• a.A logical topology map of the whole campus
• b.An IP address plan
• c.A rack diagram✓
• d.A cable test report

A rack diagram (rack elevation) depicts the front and rear layout of equipment by rack unit, aiding installation and airflow planning. It shows occupancy, weight, and power distribution. Keeping it current prevents installation surprises.

To speed future troubleshooting, a cabling contractor marks each cable end and patch-panel port with a consistent identifier. Which documentation practice is this?

• a.Publishing a service level agreement
• b.Cable and port labeling✓
• c.Drawing a full mesh topology
• d.Maintaining a spanning-tree convergence diagram

Standardized cable and port labeling lets technicians trace connections quickly and reduces errors during moves and changes. Labels should follow a documented naming convention. Good labeling pays off most during outages.

An organization stores a known-good, standard device configuration that all similar switches should match. What is this reference called?

• a.A memorandum of understanding
• b.A configuration baseline✓
• c.A disaster recovery plan
• d.An after-action incident report

A configuration baseline is the documented standard build that devices should conform to, making drift easy to spot. Comparing a running config against it reveals unauthorized changes. It also speeds provisioning of replacement hardware.

Finance and security both need an authoritative list of every network device, its model, serial number, and warranty status. Which record provides this?

• a.An asset inventory✓
• b.A logical topology diagram
• c.A quality-of-service marking policy
• d.The firewall rule set

An asset inventory catalogs hardware and software with details like model, serial, location, and lifecycle status. It supports warranty, licensing, and end-of-life planning. Accurate inventory underpins both security and budgeting.

After a Wi-Fi deployment, an engineer documents measured signal strength across the floor as a color-coded coverage map. What is this artifact?

• a.A site survey heat map✓
• b.A rack elevation showing every device mounted in the cabinet
• c.An SLA compliance report
• d.A logical VLAN diagram

A wireless site survey heat map visualizes signal strength and coverage, revealing dead zones and overlap. It guides AP placement and channel planning. Surveys are done before deployment (predictive) and after (validation).

In a multi-floor building, cabling from each floor's wiring closet runs back to a central equipment room. What is the per-floor closet called?

• a.The default gateway for the floor
• b.An IDF✓
• c.The native VLAN on the trunk
• d.A separate broadcast domain

An IDF (intermediate distribution frame) is a floor or zone wiring closet that connects back to the MDF (main distribution frame). Documenting IDF/MDF locations and links is essential for structured cabling. This hierarchy keeps runs within distance limits.

After a project is complete, a team updates the diagrams to reflect exactly how the network was actually built, including last-minute field changes. What is this documentation called?

• a.As-built documentation✓
• b.A predictive site survey
• c.A request-for-change ticket
• d.The original pre-construction design proposal

As-built documentation records the real, final state of an installation, including deviations from the original design. It is more accurate than the planning drawings because it captures field changes. Keeping it current prevents surprises during later work.

A regulator requires proof that network controls are periodically checked against policy and standards by an independent review. Which activity satisfies this?

• a.A network audit✓
• b.A firmware upgrade
• c.A change freeze
• d.A predictive wireless coverage survey

A network audit is an independent review that verifies configurations, access, and controls against policy and standards. It produces findings and remediation items. Regular audits demonstrate compliance and surface drift or gaps.

A new technician needs a documented, repeatable set of steps for safely rebooting a core switch during a maintenance window. Which document provides this?

• a.A vendor master service agreement
• b.An acceptable use policy
• c.A standard operating procedure✓
• d.A network topology diagram

A standard operating procedure (SOP) documents the exact, repeatable steps for a routine task, reducing errors and inconsistency. It captures institutional knowledge so any qualified staff member can perform the work. SOPs support both safety and compliance.

An operations team keeps a record of each vendor, the equipment covered, support entitlements, and renewal dates so contracts do not lapse. Which document is this?

• a.A spanning-tree diagram
• b.A vendor support contract record✓
• c.A one-time packet capture from the core switch
• d.A wireless heat map

A vendor support contract record tracks coverage levels, entitlements, and renewal dates so critical support does not lapse unnoticed. It links assets to their applicable service agreements. This avoids scrambling for support during an outage on out-of-contract gear.

Two routers should share a single virtual gateway IP so that if the active router fails, the standby takes over transparently to hosts. Which category of protocol provides this?

• a.The Address Resolution Protocol used for local delivery
• b.A first hop redundancy protocol✓
• c.Spanning Tree Protocol
• d.Network Time Protocol

A first hop redundancy protocol such as VRRP or HSRP presents one virtual gateway IP backed by multiple routers, enabling automatic failover. Hosts keep the same gateway address regardless of which router is active. This removes the gateway as a single point of failure.

A design distributes live traffic across two data centers simultaneously so both handle load and either can absorb the other's share. Which model is this?

• a.Active-active✓
• b.A single node with no redundancy
• c.Cold standby only
• d.Active-passive with an idle standby node held in reserve

An active-active design runs both nodes or sites simultaneously, sharing load and providing redundancy. If one fails, the other absorbs its traffic, though capacity planning must allow for it. Active-passive instead keeps a standby idle until needed.

A load balancer must send each new client connection to the next server in a repeating list, distributing sessions evenly. Which distribution method is this?

• a.Least connections
• b.Weighted response time
• c.Source-IP hashing that pins a client to one server
• d.Round robin✓

Round robin sends each successive request to the next server in rotation, distributing connections evenly without regard to load. Least-connections and weighted methods account for server capacity or current load. The right method depends on how uniform the servers and sessions are.

A server should keep network connectivity even if one of its two network cards or switch uplinks fails. Which server-side technique provides this?

• a.Static ARP entries
• b.Enabling jumbo frames on the interface
• c.Port mirroring
• d.NIC teaming✓

NIC teaming (bonding) groups multiple physical adapters so the server tolerates a NIC, cable, or switch-port failure, and can add throughput. Modes include active-backup and load-balancing. It protects the host's connection independently of the network core.

A core switch should keep running if a single power source fails, without any interruption. Which hardware feature provides this?

• a.A larger cooling fan
• b.A single higher-wattage power supply
• c.Power over Ethernet on the uplink
• d.Redundant power supplies✓

Dual (redundant) power supplies let a device keep running if one supply or feed fails, ideally each on a separate circuit. This removes the power supply as a single point of failure. Pairing them with independent PDUs and UPS units maximizes resilience.

Several servers act as one system so that if a node fails, the remaining nodes continue the service with minimal disruption. What is this arrangement called?

• a.A demilitarized zone
• b.Clustering✓
• c.A single-server deployment with nightly backups only
• d.Port aggregation

Clustering groups multiple servers so they function as a single, resilient service, with surviving nodes taking over on failure. It supports high availability and sometimes load sharing. Shared or replicated storage often backs the cluster.

An organization wants its internet access to survive the total failure of one provider by contracting a second, independent carrier. Which approach is this?

• a.Multiple ISPs (multihoming)✓
• b.A larger DHCP scope
• c.Enabling QoS on the WAN edge
• d.A faster single circuit from one provider

Using multiple ISPs (multihoming) provides path and provider redundancy so a single carrier outage does not sever internet access. Ideally the links enter through diverse physical paths. BGP or policy routing steers traffic across the providers.

A facility must keep critical network gear running through a multi-hour utility power outage. Beyond battery backup, which resource provides sustained power?

• a.A backup generator✓
• b.A redundant cooling unit
• c.A second internet circuit
• d.A single uninterruptible power supply on its own

A backup generator supplies sustained power during extended utility outages, well beyond the minutes a UPS battery provides. The UPS bridges the gap while the generator starts. Together they form a layered power-resilience strategy.

After a link failure, a Layer 2 network must recover forwarding paths in a second or two rather than the tens of seconds classic STP takes. Which protocol provides this faster convergence?

• a.RSTP✓
• b.Border Gateway Protocol
• c.Classic STP (802.1D)
• d.The first hop redundancy protocol used for gateways

Rapid Spanning Tree Protocol (RSTP, 802.1w) converges in a few seconds versus the roughly 30-50 seconds of classic STP. It uses proposal/agreement and additional port roles to speed recovery. It is backward compatible with legacy STP.

During a brief utility power sag, network gear must stay up on battery for the few minutes needed to switch to generator or shut down cleanly. Which device provides this immediate bridge?

• a.A second default gateway
• b.A backup generator with a startup delay
• c.A redundant switch fabric
• d.An uninterruptible power supply✓

An uninterruptible power supply (UPS) provides immediate battery power to ride through sags and short outages and to bridge to a generator. It also conditions power against spikes. Sizing it correctly determines how long equipment stays up.

A shelf holds a preconfigured, powered-off replacement switch that can be swapped in quickly, but it is not already running. What is this spare called?

• a.A load-balanced active-active pair already carrying traffic
• b.A hot spare
• c.A cold spare✓
• d.A warm site

A cold spare is a spare device kept powered off and ready to be installed when the primary fails, trading faster-than-procurement recovery for some downtime. A hot spare is already running and can take over immediately. The choice balances cost against recovery speed.

To survive the loss of an entire building or region, an organization replicates services to a second location far from the primary. Which resilience strategy is this?

• a.A larger single data center with more racks
• b.Geographic redundancy✓
• c.NIC teaming on each server
• d.Dual power supplies in one chassis

Geographic (site) redundancy places services in a separate location so a regional disaster does not take down everything at once. Data is replicated between sites to keep them in sync. It is the broadest tier of high-availability design.

A disaster recovery plan states that a critical system must be fully restored and usable within four hours of an outage. Which metric expresses this target?

• a.RPO
• b.MTBF
• c.RTO✓
• d.MTTR, which measures average repair time after a failure

The Recovery Time Objective (RTO) is the maximum tolerable time to restore a system after an outage. It drives investment in failover and recovery capability. RTO differs from RPO, which addresses acceptable data loss rather than downtime.